ios内核漏洞挖掘

《ios内核漏洞挖掘》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、iOS内核漏洞挖掘-Fuzz&代码审计议程•iOS内核漏洞•Fuzz系统•代码审计•漏洞分析iOS安全体系•安全机制–CodeSign–Sandbox–Read-onlyRootFS–…•功能多在内核层实现–需要patch内核来defeatiOS内核漏洞•传统桌面系统内核漏洞–能在低权限帐户触发–修改进程标志位->提权为System进程•iOS内核漏洞–Sandbox内/外触发–Mobile/Root触发–Patch内核代码iOS内核溢出保护•溢出保护–KASLR–Kernelpointerobfuscation–Stack/Heapcookie–Kernelspaceis

2、olation–KernelcodepageisR-X–Kernelheapisnotexecutable–…议程•iOS内核漏洞•Fuzz系统•代码审计•漏洞分析Fuzz系统•WhyFuzz–容易实现–覆盖面广–Apple的代码质量不高–低投入高产出Fuzz系统•WhyNOTFuzz–分析困难（无法调试）–Panic多/Exploitable少–欠缺精度Fuzz系统•WheretoFuzz–ioctl–sysctl–IOKit–Filesystem–Network–…BestTarget•IOKit–扩展设备大多基于IOKit–调用接口简单-IOConnectCallMe

3、thod–IOKitExtensions大多闭源–部分设备可在sandbox内打开IOKitFuzz•被动Fuzz–更容易实现–测试面狭窄–需要人工干预–PoC精简相对麻烦•主动Fuzz–需要不少准备工作–测试覆盖面更广–自动化–PoC往往更简洁被动IOKitFuzz•核心思想–hook–CydiaSubstrate•需要依赖CydiaSubstrate环境•可以一次注入所有进程–Dyldinterposefeature•实现简单•需要自己实现注入–DYLD_INSERT_LIBRARIES被动IOKitFuzz•HookIOConnectCallMethodkern_re

4、turn_tIOConnectCallMethod(mach_port_tconnection,//Inuint32_tselector,//Inconstuint64_t*input,//Inuint32_tinputCnt,//Inconstvoid*inputStruct,//Insize_tinputStructCnt,//Inuint64_t*output,//Outuint32_t*outputCnt,//In/Outvoid*outputStruct,//Outsize_t*outputStructCntP)//In/Out被动IOKitFuzz•input–

5、填充随机uint64_t•inputStruct–任意填充随机数据–解析结构后替换某些数据•XML•…被动IOKitFuzz•注入进程选择–MobileSafari–…主动IOKitFuzz•枚丼所有可打开的设备•枚丼设备对应的扩展方法–selector–inputCnt/inputStructCnt–outputCnt/outputStructCnt•主动测试所有的接口主动IOKitFuzz•IOConnectCallMethod->IOUserClient::externalMethod–ifdispatch!=NULL•Sizecheck•(*dispatch->fu

6、nction)(target,reference,args);–elsemethod=getTargetAndMethodForIndex(&object,selector)•Sizecheck•method->func主动IOKitFuzz•FindstructurestructIOExternalMethodDispatch{IOExternalMethodActionfunction;uint32_tcheckScalarInputCount;uint32_tcheckStructureInputSize;uint32_tcheckScalarOutputCount;

7、uint32_tcheckStructureOutputSize;};structIOExternalMethod{IOService*object;IOMethodfunc;IOOptionBitsflags;IOByteCountcount0;IOByteCountcount1;};主动IOKitFuzz•Overridingmethods–externalMethod–getTargetAndMethodForIndex–getExternalMethodForIndex主动IOKitFuzz•动态获取–枚丼